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DETAILED ACTION 

1. Claims 1-8,10,15-25,27-36,38 and 43-58 are subject to examination. New claims 52 and 
57 are allowable but objected to. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

3. Claims 1-8,10,15-25,27-36,38 and 43-51, 53-56, 58 are rejected under 35 U.S.C. 102(e) 
as being anticipated by Chaar et al. 6,857,020 (Hereinafter Chaar-IBM). 

4. Referring to claim 1, Chaar-IBM discloses a method for capturing behavior for network 
components and for interactions between components comprising: accessing first data that 
defines one or more states and state transitions for a particular component or interaction between 
a particular two or more components (e.g., figures 4, 6A, col, 6), wherein the first data defines at 
least one composite state transition, each of said composite state transition comprising multiple 
state transitions (e.g., col, 9); and in response to the particular component or interaction between 
the particular two or more components entering a particular state or state transition (e.g., col, 9), 
generating a notification corresponding to the particular state or state transition, wherein the 
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particular state or state transition is one of the one or more states and state transitions (e.g., col, 
11). 

5. Referring to claim 2, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the one or more states are specified based on thresholds (e.g., 
col, 7). 

6. Referring to claim 3, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the notification is an event (e.g., col., 9). 

7. Referring to claim 4, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the particular component or interaction between the particular 
two or more components is a component (e.g., col., 10), and wherein the step of generating the 
notification comprises generating the notification by the component (e.g., col., 10). 

8. Referring to claim 5, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the particular component or interaction between the particular 
two or more components is an interaction between the particular two or more components (e.g., 
col, 10), and wherein the notification is generated by at least one of the particular two or more 
components (e.g., col, 10). 
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9. Referring to claim 6, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses reporting the notification to a network management system (e.g., col, 
6). 

10. Referring to claim 7, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses detecting that the particular component or interaction between the 
particular two or more components has entered the particular state or state transition (e.g., col., 
9); and wherein said notification is generated in response to said step of detecting (e.g., col., 9). 

1 1 . Referring to claim 8, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein, the step of detecting is performed by an agent, said agent 
being different than the particular component (e.g., col., 1 1). 

12. Referring to claim 10, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses polling the particular component or the particular two or more 
components to determine that the particular state or state transition has occurred (e.g., col, 12). 

13. Referring to claim 15, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the set of one or more illegal states or state transitions 
comprises a state associated with an authorization violation or an authentication forgery (e.g., 
col, 9). 
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14. Referring to claim 16, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the set of one or more undesirable states or state transitions 
comprises a state associated with a sudden quality of service degradation or a violation of a 
service level agreement (e.g., col., 10). 

15. Referring to claim 17, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses examining multiple notifications to deduce one or more trends 
regarding the network (e.g., col., 9). 

16. Referring to claim 18, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the step of examining multiple notifications comprises 
examining notifications for stable-behavior in a threshold value for a particular trend (e.g. col, 
11). 

17. Referring to claim 19, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the step of examining multiple notifications comprises 
examining notifications for increases or decreases in a threshold value for a particular trend (e.g., 
col, 11). 

18. Referring to claim 20, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses computer-based system for capturing behavior for network 
components and for interactions between components (e.g., col, 6), the system comprising: one 
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or more network components, each network component configured to spontaneously generate 
notifications when specified states and state transitions occur involving the network component 
(e.g., col, 9), wherein the specified state and state transitions include one or more composite 
state transitions, each of said composite state transition comprising multiple state transitions 
(e.g., col, 11) and a network management system configured to receive said spontaneously 
generated notifications (e.g., col., 11). 

19. Referring to claim 21, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses an agent configured to detect the generation of notifications by the 
network components, and configured to report detected notifications to said network 
management system (e.g., col, 10). 

20. Referring to claim 22, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses a state tabic configured to store said specified states and state 
transitions, including composite state transitions (e.g., col., 11). 



21. Referring to claim 23, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the state table is in a network management system (e.g., col, 
V). 



Application/Control Number: 1 0/637, 1 74 Page 7 

Art Unit: 2154 

22. Referring to claim 24, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the state table is in one of the one or more network 
components (e.g., col, 10). 

23. Referring to claim 25, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the agent is further configured to examine one or more 
conditions of one or more network components and to query the state table storing said specified 
states and state transitions to determine whether the one or more conditions represents an illegal 
or undesirable state or state transition (e.g., col., 1 1). 

24. Referring to claim 27, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses a computer-based system for capturing illegal and undesired behavior 
for network components and for interactions between components (e.g., col., 6)comprising: one 
or more network components (e.g., col., 6); an agent configured to examine said network 
components to determine whether specified states or state transitions, including composite state 
transitions, have occurred (e.g., col., 9), wherein the agent is configured to generate notifications 
upon a determination that a specified state or state transition has occurred, wherein the agent is 
configured to report detected notifications to a network management system (e.g., col, 9); 
wherein each of said composite state transition comprises multiple state transitions; wherein the 
specified states and state transitions comprise (1) a set of undesirable states or state transitions 
associated with undesirable behavior (e.g., col., 1 1) and (2) a set of illegal states or state 
transitions associated with illegal behavior (e.g., col., 1 1), said set of illegal states and state 
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transitions being different than said set of undesirable states or state transitions (e.g., col, 1 1); 
and said network management system configured to receive reports of said generated 
notifications (e.g., col, 11). 

25. Referring to claim 28, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses a state table configured to store said specified states and state 
transitions, including composite state transitions (e.g., col., 10). 

26. Referring to claim 29, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses computer-readable storage medium carrying one or more sequences of 
instructions for capturing behavior for network components and for interactions between 
components (e.g., col, 6), which instructions, when executed by one or more processors, cause 
the one or more processors to carry out the steps of: accessing first data that defines one or more 
states and state transitions for a particular component or interaction between a particular two or 
more components (e.g., col., 6), wherein the first data defines at least one composite state 
transition, each of said composite state transition comprising multiple state transitions (e.g., col., 
6)and in response to the particular component or interaction between the particular two or more 
components entering a particular state or state transition generating a notification corresponding 
to the particular state or state transition (e.g., col., 1 1), wherein the particular state or state 
transition is one of the one or more states and state transitions (e.g., col, 1 1). 
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27. Referring to claim 30, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the one or more states are specified based on thresholds (e.g., 
col, 9). 

28. Referring to claim 31, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein said notifications are events (e.g., col, 10). 

29. Referring to claim 32, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the particular component or interaction between the particular 
two or more components is a component (e.g., col., 1 1), and wherein the step of generating the 
notification comprises generating the notification by the component (e.g., col., 1 1). 

30. Referring to claim 33, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the particular component or interaction between the particular 
two or more components is an interaction between the particular two or more components (e.g., 
col, 10), and wherein the notification is generated by at least one of the particular two or more 
components (e.g., col, 10). 

3 1 . Referring to claim 34, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of: reporting the 
notification to a network management system (e.g., col., 1 1). 
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32. Referring to claim 35, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the steps of: detecting that 
the particular component or interaction between the particular two or more components has 
entered the particular state or state transition (e.g., col., 10); and wherein said notification is 
generated in response to said step of detecting (e.g., col., 10). 

33. Referring to claim 36, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the step of detecting is performed by an agent, said agent 
being different than the particular component (e.g., col., 9). 

34. Referring to claim 38, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of: polling the 
particular component or the particular two or more components to determine that the particular 
state or state transition has occurred (e.g., col., 1 1). 

35. Referring to claim 43, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the set of one or more illegal states or state transitions 
comprises a state associated with an authorization violation or an authentication forgery (e.g., 
col, 9). 
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36. Referring to claim 44, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the set of one or more undesirable states or state transitions 
comprises a state associated with a sudden quality of service degradation or a violation of a 
service level agreement (e.g., col, 10). 



37. Referring to claim 45, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of examining 
multiple notifications to deduce one or more trends regarding the network (e.g., col, 9). 



38. Referring to claim 46, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the step of examining multiple notifications comprises 
examining notifications for stable-behavior in a threshold value for a particular trend (e.g., col., 
10). 



39. Referring to claim 47, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the step of examining multiple notifications comprises 
examining notifications for increases or decreases in a threshold value for a particular trend (e.g., 
col.,. 10). 
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40. Referring to claims 48 and 54, Chaar-IBM discloses the claimed limitations as rejected 
above. Chaar-IBM also discloses accessing second data that indicates, for the particular 
component or interaction between the particular two or more components (e.g., col, 6), a set of 
one or more undesirable states or state transitions (e.g., col., 6); wherein each of said one or more 
undesirable states or state transitions is a state or state transition of the one or more states and 
state transitions that is associated with undesirable behavior (e.g., col, 7); and accessing third 
data that indicates, for the particular component or interaction between the particular two or 
more components, a set of one or more illegal states or state transitions (e.g., col, 7); wherein 
each of said one or more illegal states or state transitions is a state or state transition of the one or 
more states and state transitions that is associated with illegal behavior (e.g., col, 9); wherein the 
set of one or more illegal states is different from the set of one or more undesirable states (e.g., 
col, 9); wherein the particular state or state transition belongs to either the set of one or more 
undesirable states or state transitions or the set of one or more illegal states or state transitions 
(e.g., col, 9). 

41 . Referring to claim 49, Chaar-IBM discloses the claimed limitations as rejected above. 
Chaar-IBM also discloses wherein the specified states and state transitions comprise (1) a set of 
undesirable states or state transitions associated with undesirable behavior (e.g., col, 10) and (2) 
a set of illegal states or state transitions associated with illegal behavior, said set of illegal states 
and state transitions being different than said set of undesirable states or state transitions (e.g., 
col, 10). 
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42. Referring to claims 50 and 55, Chaar-IBM discloses the claimed limitations as rejected 
above. Chaar-IBM also discloses wherein the first data is stored in a state table in a network 
management system, wherein the step of generating is performed by a component or agent 
separate from the network management system (e.g., col., 10). 

43. Referring to claims 5 1 and 56, Chaar-IBM discloses the claimed limitations as rejected 
above. Chaar-IBM also discloses wherein the first data is stored in a state table in the particular 
component or in at least one of the two or more particular components (e.g., col, 1 1). 

44. Referring to claims 53 and 58, Chaar-IBM discloses the claimed limitations as rejected 
above. Chaar-IBM also discloses wherein the particular state or state transition is a composite 
state transition (e.g., col., 9). 

45. Claims 1-8,10,15-25,27-36,38 and 43-51, 53-56, 58 are rejected under 35 U.S.C. 102(e) 
as being anticipated by Bradley et al. 7,082,463 (Hereinafter Bradley-CICSO). 

46. Referring to claim 1, Bradley-CICSO discloses a method for capturing behavior for 
network components and for interactions between components comprising: accessing first data 
that defines one or more states and state transitions for a particular component or interaction 
between a particular two or more components (e.g., col., 4), wherein the first data defines at least 
one composite state transition, each of said composite state transition comprising multiple state 
transitions (e.g., col, 5); and in response to the particular component or interaction between the 
particular two or more components entering a particular state or state transition (e.g., col, 5), 
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generating a notification corresponding to the particular state or state transition, wherein the 
particular state or state transition is one of the one or more states and state transitions (e.g., col, 
9). 



47. Referring to claim 2, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses wherein the one or more states are specified based on thresholds 
(e.g., col, 10). 



48. Referring to claim 3, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses wherein the notification is an event (e.g., col., 5). 



49. Referring to claim 4, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses wherein the particular component or interaction between the 
particular two or more components is a component (e.g., col., 10), and wherein the step of 
generating the notification comprises generating the notification by the component (e.g., col, 
10). 



50. Referring to claim 5, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses wherein the particular component or interaction between the 
particular two or more components is an interaction between the particular two or more 
components (e.g., col, 10), and wherein the notification is generated by at least one of the 
particular two or more components (e.g., col., 10). 



Application/Control Number: 10/637,174 
Art Unit: 2154 



Page 15 



5 1 . Referring to claim 6, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses reporting the notification to a network management system (e.g., 
col, 4). 

52. Referring to claim 7, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses detecting that the particular component or interaction between the 
particular two or more components has entered the particular state or state transition (e.g., col, 
5); and wherein said notification is generated in response to said step of detecting (e.g., col., 5). 

53. Referring to claim 8, Bradley-CICSO discloses the claimed limitations as rejected above. 
Bradley-CICSO also discloses wherein, the step of detecting is performed by an agent, said agent 
being different than the particular component (e.g., col., 9). 

54. Referring to claim 10, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses polling the particular component or the particular two or 
more components to determine that the particular state or state transition has occurred (e.g., col, 
12). 



55. Referring to claim 15, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the set of one or more illegal states or state 
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transitions comprises a state associated with an authorization violation or an authentication 
forgery (e.g., col, 5). 

56. Referring to claim 16, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the set of one or more undesirable states or state 
transitions comprises a state associated with a sudden quality of service degradation or a 
violation of a service level agreement (e.g., col., 10). 

57. Referring to claim 17, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses examining multiple notifications to deduce one or more 
trends regarding the network (e.g., col, 5). 

58. Referring to claim 18, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the step of examining multiple notifications 
comprises examining notifications for stable-behavior in a threshold value for a particular trend 
(e.g. col, 9). 

59. Referring to claim 19, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the step of examining multiple notifications 
comprises examining notifications for increases or decreases in a threshold value for a particular 
trend (e.g., col, 9). 
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60. Referring to claim 20, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses computer-based system for capturing behavior for network 
components and for interactions between components (e.g., col., 4), the system comprising: one 
or more network components, each network component configured to spontaneously generate 
notifications when specified states and state transitions occur involving the network component 
(e.g., col, 5), wherein the specified state and state transitions include one or more composite 
state transitions, each of said composite state transition comprising multiple state transitions 
(e.g., col, 9) and a network management system configured to receive said spontaneously 
generated notifications (e.g., col., 9). 

61. Referring to claim 21, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses an agent configured to detect the generation of 
notifications by the network components, and configured to report detected notifications to said 
network management system (e.g., col., 10). 

62. Referring to claim 22, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses a state table configured to store said specified states and 
state transitions, including composite state transitions (e.g., col., 9). 

63. Referring to claim 23, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the state table is in a network management system 
(e.g., col, 10). 
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64. Referring to claim 24, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the state table is in one of the one or more 
network components (e.g., col, 10). 

65. Referring to claim 25, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the agent is further configured to examine one or 
more conditions of one or more network components and to query the state table storing said 
specified states and state transitions to determine whether the one or more conditions represents 
an illegal or undesirable state or state transition (e.g., col., 9). 

66. Referring to claim 27, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses a computer-based system for capturing illegal and 
undesired behavior for network components and for interactions between components (e.g., col., 
4)comprising: one or more network components (e.g., col., 4); an agent configured to examine 
said network components to determine whether specified states or state transitions, including 
composite state transitions, have occurred (e.g., col., 5), wherein the agent is configured to 
generate notifications upon a determination that a specified state or state transition has occurred, 
wherein the agent is configured to report detected notifications to a network management system 
(e.g., col, 5); wherein each of said composite state transition comprises multiple state transitions; 
wherein the specified states and state transitions comprise (1) a set of undesirable states or state 
transitions associated with undesirable behavior (e.g., col., 9) and (2) a set of illegal states or 
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state transitions associated with illegal behavior (e.g., col., 9), said set of illegal states and state 
transitions being different than said set of undesirable states or state transitions (e.g., col, 9); and 
said network management system configured to receive reports of said generated notifications 
(e.g., col, 9). 

67. Referring to claim 28, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses a state table configured to store said specified states and 
state transitions, including composite state transitions (e.g., col., 10). 

68. Referring to claim 29, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses computer-readable storage medium carrying one or more 
sequences of instructions for capturing behavior for network components and for interactions 
between components (e.g., col., 4), which instructions, when executed by one or more 
processors, cause the one or more processors to carry out the steps of: accessing first data that 
defines one or more states and state transitions for a particular component or interaction between 
a particular two or more components (e.g., col., 4), wherein the first data defines at least one 
composite state transition, each of said composite state transition comprising multiple state 
transitions (e.g., col, 4)and in response to the particular component or interaction between the 
particular two or more components entering a particular state or state transition generating a 
notification corresponding to the particular state or state transition (e.g., col, 9), wherein the 
particular state or state transition is one of the one or more states and state transitions (e.g., col, 
9). 
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69. Referring to claim 30, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the one or more states are specified based on 
thresholds (e.g., col, 5). 

70. Referring to claim 3 1 , Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein said notifications are events (e.g., col, 10). 

71. Referring to claim 32, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the particular component or interaction between 
the particular two or more components is a component (e.g., col., 9), and wherein the step of 
generating the notification comprises generating the notification by the component (e.g., col, 9). 

72. Referring to claim 33, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the particular component or interaction between 
the particular two or more components is an interaction between the particular two or more 
components (e.g., col, 10), and wherein the notification is generated by at least one of the 
particular two or more components (e.g., col., 10). 

73. Referring to claim 34, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the instructions for carrying out the step of 
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creating and storing first information further comprise instructions for carrying out the step of: 
reporting the notification to a network management system (e.g., col, 9). 

74. Referring to claim 35, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the steps of: 
detecting that the particular component or interaction between the particular two or more 
components has entered the particular state or state transition (e.g., col., 10); and wherein said 
notification is generated in response to said step of detecting (e.g., col., 10). 

75. Referring to claim 36, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the step of detecting is performed by an agent, 
said agent being different than the particular component (e.g., col., 5). 

76. Referring to claim 38, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the step of: 
polling the particular component or the particular two or more components to determine that the 
particular state or state transition has occurred (e.g., col., 9). 

77. Referring to claim 43, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the set of one or more illegal states or state 
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transitions comprises a state associated with an authorization violation or an authentication 
forgery (e.g., col, 5). 



78. Referring to claim 44, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the set of one or more undesirable states or state 
transitions comprises a state associated with a sudden quality of service degradation or a 
violation of a service level agreement (e.g., col., 10). 



79. Referring to claim 45, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the step of 
examining multiple notifications to deduce one or more trends regarding the network (e.g., col, 
5). 



80. Referring to claim 46, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the step of examining multiple notifications 
comprises examining notifications for stable-behavior in a threshold value for a particular trend 
(e.g., col, 10). 



8 1 . Referring to claim 47, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the step of examining multiple notifications 
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comprises examining notifications for increases or decreases in a threshold value for a particular 
trend (e.g., col.,. 10). 

82. Referring to claims 48 and 54, Bradley-CICSO discloses the claimed limitations as 
rejected above. Bradley-CICSO also discloses accessing second data that indicates, for the 
particular component or interaction between the particular two or more components (e.g., col, 
4), a set of one or more undesirable states or state transitions (e.g., col., 4); wherein each of said 
one or more undesirable states or state transitions is a state or state transition of the one or more 
states and state transitions that is associated with undesirable behavior (e.g., col., 10); and 
accessing third data that indicates, for the particular component or interaction between the 
particular two or more components, a set of one or more illegal states or state transitions (e.g., 
col, 10); wherein each of said one or more illegal states or state transitions is a state or state 
transition of the one or more states and state transitions that is associated with illegal behavior 
(e.g., col, 5); wherein the set of one or more illegal states is different from the set of one or more 
undesirable states (e.g., col, 5); wherein the particular state or state transition belongs to either 
the set of one or more undesirable states or state transitions or the set of one or more illegal states 
or state transitions (e.g., col, 5). 

83. Referring to claim 49, Bradley-CICSO discloses the claimed limitations as rejected 
above. Bradley-CICSO also discloses wherein the specified states and state transitions comprise 
(1) a set of undesirable states or state transitions associated with undesirable behavior (e.g., col, 
10) and (2) a set of illegal states or state transitions associated with illegal behavior, said set of 
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illegal states and state transitions being different than said set of undesirable states or state 
transitions (e.g., col, 10). 

84. Referring to claims 50 and 55, Bradley-CICSO discloses the claimed limitations as 
rejected above. Bradley-CICSO also discloses wherein the first data is stored in a state table in a 
network management system, wherein the step of generating is performed by a component or 
agent separate from the network management system (e.g., col., 10). 

85. Referring to claims 51 and 56, Bradley-CICSO discloses the claimed limitations as 
rejected above. Bradley-CICSO also discloses wherein the first data is stored in a state table in 
the particular component or in at least one of the two or more particular components (e.g., col, 
9). 

86. Referring to claims 53 and 58, Bradley-CICSO discloses the claimed limitations as 
rejected above. Bradley-CICSO also discloses wherein the particular state or state transition is a 
composite state transition (e.g., col., 5). 

87. Claims 1-8,10,15-25,27-36,38 and 43-51, 53-56, 58 are rejected under 35 U.S.C. 102(e) 
as being anticipated by Anandakumar et al. 6,801,532 (Hereinafter Anandakumar-TXN). 

88. Referring to claim 1, Anandakumar-TXN discloses a method for capturing behavior for 
network components and for interactions between components comprising: accessing first data 
that defines one or more states and state transitions for a particular component or interaction 
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between a particular two or more components (e.g., figure 16, col, 14), wherein the first data 
defines at least one composite state transition, each of said composite state transition comprising 
multiple state transitions (e.g., col., 15); and in response to the particular component or 
interaction between the particular two or more components entering a particular state or state 
transition (e.g., col, 15), generating a notification corresponding to the particular state or state 
transition, wherein the particular state or state transition is one of the one or more states and state 
transitions (e.g., col, 19). 

89. Referring to claim 2, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the one or more states are specified based on 
thresholds (e.g., col., 20). 

90. Referring to claim 3, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the notification is an event (e.g., col., 15). 

91 . Referring to claim 4, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the particular component or interaction 
between the particular two or more components is a component (e.g., col., 20), and wherein the 
step of generating the notification comprises generating the notification by the component (e.g., 
col, 20). 
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92. Referring to claim 5, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the particular component or interaction 
between the particular two or more components is an interaction between the particular two or 
more components (e.g., col, 20), and wherein the notification is generated by at least one of the 
particular two or more components (e.g., col., 20). 

93. Referring to claim 6, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses reporting the notification to a network management 
system (e.g., col, 14). 

94. Referring to claim 7, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses detecting that the particular component or interaction 
between the particular two or more components has entered the particular state or state transition 
(e.g., col, 15); and wherein said notification is generated in response to said step of detecting 
(e.g., col, 15). 

95. Referring to claim 8, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein, the step of detecting is performed by an 
agent, said agent being different than the particular component (e.g., col., 19). 

96. Referring to claim 10, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses polling the particular component or the particular two 
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or more components to determine that the particular state or state transition has occurred (e.g., 
col, 12). 

97. Referring to claim 15, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the set of one or more illegal states or state 
transitions comprises a state associated with an authorization violation or an authentication 
forgery (e.g., col, 15). 

98. Referring to claim 16, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the set of one or more undesirable states or 
state transitions comprises a state associated with a sudden quality of service degradation or a 
violation of a service level agreement (e.g., col., 20). 

99. Referring to claim 17, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses examining multiple notifications to deduce one or 
more trends regarding the network (e.g., col, 15). 

100. Referring to claim 18, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the step of examining multiple notifications 
comprises examining notifications for stable-behavior in a threshold value for a particular trend 
(e.g. col, 19). 
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101 . Referring to claim 19, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the step of examining multiple notifications 
comprises examining notifications for increases or decreases in a threshold value for a particular 
trend (e.g., col, 19). 

102. Referring to claim 20, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses computer-based system for capturing behavior for 
network components and for interactions between components (e.g., col., 14), the system 
comprising: one or more network components, each network component configured to 
spontaneously generate notifications when specified states and state transitions occur involving 
the network component (e.g., col., 15), wherein the specified state and state transitions include 
one or more composite state transitions, each of said composite state transition comprising 
multiple state transitions (e.g., col., 19) and a network management system configured to receive 
said spontaneously generated notifications (e.g., col., 19). 

103. Referring to claim 21, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses an agent configured to detect the generation of 
notifications by the network components, and configured to report detected notifications to said 
network management system (e.g., col., 20). 
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104. Referring to claim 22, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses a state table configured to store said specified states 
and state transitions, including composite state transitions (e.g., col, 19). 

105. Referring to claim 23, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the state table is in a network management 
system (e.g., col., 20). 

106. Referring to claim 24, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the state table is in one of the one or more 
network components (e.g., col., 20). 

107. Referring to claim 25, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the agent is further configured to examine one 
or more conditions of one or more network components and to query the state table storing said 
specified states and state transitions to determine whether the one or more conditions represents 
an illegal or undesirable state or state transition (e.g., col., 19). 

108. Referring to claim 27, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses a computer-based system for capturing illegal and 
undesired behavior for network components and for interactions between components (e.g., col, 
14)comprising: one or more network components (e.g., col., 14); an agent configured to examine 
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said network components to determine whether specified states or state transitions, including 
composite state transitions, have occurred (e.g., col., 15), wherein the agent is configured to 
generate notifications upon a determination that a specified state or state transition has occurred, 
wherein the agent is configured to report detected notifications to a network management system 
(e.g., col, 15); wherein each of said composite state transition comprises multiple state 
transitions; wherein the specified states and state transitions comprise (1) a set of undesirable 
states or state transitions associated with undesirable behavior (e.g., col., 19) and (2) a set of 
illegal states or state transitions associated with illegal behavior (e.g., col., 19), said set of illegal 
states and state transitions being different than said set of undesirable states or state transitions 
(e.g., col., 19); and said network management system configured to receive reports of said 
generated notifications (e.g., col., 19). 

109. Referring to claim 28, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses a state table configured to store said specified states 
and state transitions, including composite state transitions (e.g., col., 20). 

110. Referring to claim 29, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses computer-readable storage medium carrying one or 
more sequences of instructions for capturing behavior for network components and for 
interactions between components (e.g., col., 14), which instructions, when executed by one or 
more processors, cause the one or more processors to carry out the steps of: accessing first data 
that defines one or more states and state transitions for a particular component or interaction 
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between a particular two or more components (e.g., col., 14), wherein the first data defines at 
least one composite state transition, each of said composite state transition comprising multiple 
state transitions (e.g., col, 14)and in response to the particular component or interaction between 
the particular two or more components entering a particular state or state transition generating a 
notification corresponding to the particular state or state transition (e.g., col, 19), wherein the 
particular state or state transition is one of the one or more states and state transitions (e.g., col, 
19). 

111. Referring to claim 30, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the one or more states are specified based on 
thresholds (e.g., col., 15). 

1 12. Referring to claim 31, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein said notifications are events (e.g., col., 20). 

113. Referring to claim 32, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the particular component or interaction 
between the particular two or more components is a component (e.g., col., 19), and wherein the 
step of generating the notification comprises generating the notification by the component (e.g., 
col, 19). 
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114. Referring to claim 33, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the particular component or interaction 
between the particular two or more components is an interaction between the particular two or 
more components (e.g., col, 20), and wherein the notification is generated by at least one of the 
particular two or more components (e.g., col., 20). 

115. Referring to claim 34, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the step of: 
reporting the notification to a network management system (e.g., col., 19). 

116. Referring to claim 35, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the steps of: 
detecting that the particular component or interaction between the particular two or more 
components has entered the particular state or state transition (e.g., col, 20); and wherein said 
notification is generated in response to said step of detecting (e.g., col, 20). 

117. Referring to claim 36, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the step of detecting is performed by an agent, 
said agent being different than the particular component (e.g., col., 15). 
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118. Referring to claim 38, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the step of: 
polling the particular component or the particular two or more components to determine that the 
particular state or state transition has occurred (e.g., col., 19). 

119. Referring to claim 43, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the set of one or more illegal states or state 
transitions comprises a state associated with an authorization violation or an authentication 
forgery (e.g., col, 15). 

120. Referring to claim 44, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the set of one or more undesirable states or 
state transitions comprises a state associated with a sudden quality of service degradation or a 
violation of a service level agreement (e.g., col., 20). 

121 . Referring to claim 45, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the instructions for carrying out the step of 
creating and storing first information further comprise instructions for carrying out the step of 
examining multiple notifications to deduce one or more trends regarding the network (e.g., col, 
15). 
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122. Referring to claim 46, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the step of examining multiple notifications 
comprises examining notifications for stable-behavior in a threshold value for a particular trend 
(e.g., col, 20). 

123. Referring to claim 47, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the step of examining multiple notifications 
comprises examining notifications for increases or decreases in a threshold value for a particular 
trend (e.g., col.,. 20). 

124. Referring to claims 48 and 54, Anandakumar-TXN discloses the claimed limitations as 
rejected above. Anandakumar-TXN also discloses accessing second data that indicates, for the 
particular component or interaction between the particular two or more components (e.g., col., 
14), a set of one or more undesirable states or state transitions (e.g., col., 14); wherein each of 
said one or more undesirable states or state transitions is a state or state transition of the one or 
more states and state transitions that is associated with undesirable behavior (e.g., col., 20); and 
accessing third data that indicates, for the particular component or interaction between the 
particular two or more components, a set of one or more illegal states or state transitions (e.g., 
col, 20); wherein each of said one or more illegal states or state transitions is a state or state 
transition of the one or more states and state transitions that is associated with illegal behavior 
(e.g., col, 15); wherein the set of one or more illegal states is different from the set of one or 
more undesirable states (e.g., col, 15); wherein the particular state or state transition belongs to 
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either the set of one or more undesirable states or state transitions or the set of one or more 
illegal states or state transitions (e.g., col., 15). 

125. Referring to claim 49, Anandakumar-TXN discloses the claimed limitations as rejected 
above. Anandakumar-TXN also discloses wherein the specified states and state transitions 
comprise (1) a set of undesirable states or state transitions associated with undesirable behavior 
(e.g., col, 20) and (2) a set of illegal states or state transitions associated with illegal behavior, 
said set of illegal states and state transitions being different than said set of undesirable states or 
state transitions (e.g., col., 20). 

126. Referring to claims 50 and 55, Anandakumar-TXN discloses the claimed limitations as 
rejected above. Anandakumar-TXN also discloses wherein the first data is stored in a state table 
in a network management system, wherein the step of generating is performed by a component 
or agent separate from the network management system (e.g., col., 20). 

127. Referring to claims 5 1 and 56, Anandakumar-TXN discloses the claimed limitations as 
rejected above. Anandakumar-TXN also discloses wherein the first data is stored in a state table 
in the particular component or in at least one of the two or more particular components (e.g., col, 
19). 
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128. Referring to claims 53 and 58, Anandakumar-TXN discloses the claimed limitations as 
rejected above. Anandakumar-TXN also discloses wherein the particular state or state transition 
is a composite state transition (e.g., col., 15). 

129. Claims 1-8,10,15-25,27-36,38 and 43-51, 53-56, 58 are rejected under 35 U.S.C. 102(b) 
as being anticipated by Lin et al. 6,405,250 (Hereinafter Lin-Lucent). 

130. Referring to claim 1, Lin-Lucent discloses a method for capturing behavior for network 
components and for interactions between components comprising: accessing first data that 
defines one or more states and state transitions for a particular component or interaction between 
a particular two or more components (e.g., figure 5col., 3), wherein the first data defines at least 
one composite state transition, each of said composite state transition comprising multiple state 
transitions (e.g., col, 4); and in response to the particular component or interaction between the 
particular two or more components entering a particular state or state transition (e.g., col, 4), 
generating a notification corresponding to the particular state or state transition, wherein the 
particular state or state transition is one of the one or more states and state transitions (e.g., col, 
5). 



131. Referring to claim 2, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses wherein the one or more states are specified based on thresholds (e.g., col, 
6). 
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132. Referring to claim 3, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses wherein the notification is an event (e.g., col, 4). 

133. Referring to claim 4, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses wherein the particular component or interaction between the particular two 
or more components is a component (e.g., col., 8), and wherein the step of generating the 
notification comprises generating the notification by the component (e.g., col, 8). 

134. Referring to claim 5, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses wherein the particular component or interaction between the particular two 
or more components is an interaction between the particular two or more components (e.g., col, 
8), and wherein the notification is generated by at least one of the particular two or more 
components (e.g., col., 8). 

135. Referring to claim 6, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses reporting the notification to a network management system (e.g., col, 3). 

136. Referring to claim 7, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses detecting that the particular component or interaction between the 
particular two or more components has entered the particular state or state transition (e.g., col, 
4); and wherein said notification is generated in response to said step of detecting (e.g., col, 4). 
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137. Referring to claim 8, Lin-Lucent discloses the claimed limitations as rejected above. Lin- 
Lucent also discloses wherein, the step of detecting is performed by an agent, said agent being 
different than the particular component (e.g., col., 5). 

138. Referring to claim 10, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses polling the particular component or the particular two or more 
components to determine that the particular state or state transition has occurred (e.g., col, 9). 

139. Referring to claim 15, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the set of one or more illegal states or state transitions 
comprises a state associated with an authorization violation or an authentication forgery (e.g., 
col, 4). 

140. Referring to claim 16, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the set of one or more undesirable states or state transitions 
comprises a state associated with a sudden quality of service degradation or a violation of a 
service level agreement (e.g., col., 8). 

141. Referring to claim 17, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses examining multiple notifications to deduce one or more trends 
regarding the network (e.g., col, 4). 
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142. Referring to claim 18, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the step of examining multiple notifications comprises 
examining notifications for stable-behavior in a threshold value for a particular trend (e.g. col, 
5). 



143. Referring to claim 19, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the step of examining multiple notifications comprises 
examining notifications for increases or decreases in a threshold value for a particular trend (e.g., 
col, 5). 



144. Referring to claim 20, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses computer-based system for capturing behavior for network 
components and for interactions between components (e.g., col., 3), the system comprising: one 
or more network components, each network component configured to spontaneously generate 
notifications when specified states and state transitions occur involving the network component 
(e.g., col, 4), wherein the specified state and state transitions include one or more composite 
state transitions, each of said composite state transition comprising multiple state transitions 
(e.g., col, 5) and a network management system configured to receive said spontaneously 
generated notifications (e.g., col., 5). 



145. Referring to claim 21, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses an agent configured to detect the generation of notifications by the 
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network components, and configured to report detected notifications to said network 
management system (e.g., col, 8). 

146. Referring to claim 22, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses a state table configured to store said specified states and state 
transitions, including composite state transitions (e.g., col., 5). 

147. Referring to claim 23, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the state table is in a network management system (e.g., col., 
6). 

148. Referring to claim 24, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the state table is in one of the one or more network 
components (e.g., col., 8). 

149. Referring to claim 25, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the agent is further configured to examine one or more 
conditions of one or more network components and to query the state table storing said specified 
states and state transitions to determine whether the one or more conditions represents an illegal 
or undesirable state or state transition (e.g., col., 5). 
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150. Referring to claim 27, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses a computer-based system for capturing illegal and undesired behavior 
for network components and for interactions between components (e.g., col, 3)comprising: one 
or more network components (e.g., col., 3); an agent configured to examine said network 
components to determine whether specified states or state transitions, including composite state 
transitions, have occurred (e.g., col, 4), wherein the agent is configured to generate notifications 
upon a determination that a specified state or state transition has occurred, wherein the agent is 
configured to report detected notifications to a network management system (e.g., col., 4); 
wherein each of said composite state transition comprises multiple state transitions; wherein the 
specified states and state transitions comprise (1) a set of undesirable states or state transitions 
associated with undesirable behavior (e.g., col., 5) and (2) a set of illegal states or state 
transitions associated with illegal behavior (e.g., col., 5), said set of illegal states and state 
transitions being different than said set of undesirable states or state transitions (e.g., col, 5); and 
said network management system configured to receive reports of said generated notifications 
(e.g., col, 5). 

151. Referring to claim 28, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses a state table configured to store said specified states and state 
transitions, including composite state transitions (e.g., col., 8). 

152. Referring to claim 29, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses computer-readable storage medium carrying one or more sequences of 
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instructions for capturing behavior for network components and for interactions between 
components (e.g., col, 3), which instructions, when executed by one or more processors, cause 
the one or more processors to carry out the steps of: accessing first data that defines one or more 
states and state transitions for a particular component or interaction between a particular two or 
more components (e.g., col, 3), wherein the first data defines at least one composite state 
transition, each of said composite state transition comprising multiple state transitions (e.g., col, 
3)and in response to the particular component or interaction between the particular two or more 
components entering a particular state or state transition generating a notification corresponding 
to the particular state or state transition (e.g., col., 5), wherein the particular state or state 
transition is one of the one or more states and state transitions (e.g., col., 5). 

153. Referring to claim 30, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the one or more states are specified based on thresholds (e.g., 
col, 4). 

154. Referring to claim 31, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein said notifications are events (e.g., col, 8). 

155. Referring to claim 32, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the particular component or interaction between the particular 
two or more components is a component (e.g., col., 5), and wherein the step of generating the 
notification comprises generating the notification by the component (e.g., col, 5). 
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156. Referring to claim 33, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the particular component or interaction between the particular 
two or more components is an interaction between the particular two or more components (e.g., 
col, 8), and wherein the notification is generated by at least one of the particular two or more 
components (e.g., col, 8). 

157. Referring to claim 34, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of: reporting the 
notification to a network management system (e.g., col., 5). 

158. Referring to claim 35, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the steps of: detecting that 
the particular component or interaction between the particular two or more components has 
entered the particular state or state transition (e.g., col., 8); and wherein said notification is 
generated in response to said step of detecting (e.g., col., 8). 

159. Referring to claim 36, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the step of detecting is performed by an agent, said agent 
being different than the particular component (e.g., col., 4). 
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160. Referring to claim 38, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of: polling the 
particular component or the particular two or more components to determine that the particular 
state or state transition has occurred (e.g., col., 5). 

161. Referring to claim 43, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the set of one or more illegal states or state transitions 
comprises a state associated with an authorization violation or an authentication forgery (e.g., 
col, 4). 

162. Referring to claim 44, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the set of one or more undesirable states or state transitions 
comprises a state associated with a sudden quality of service degradation or a violation of a 
service level agreement (e.g., col., 8). 

163. Referring to claim 45, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the instructions for carrying out the step of creating and 
storing first information further comprise instructions for carrying out the step of examining 
multiple notifications to deduce one or more trends regarding the network (e.g., col, 4). 
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164. Referring to claim 46, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the step of examining multiple notifications comprises 
examining notifications for stable-behavior in a threshold value for a particular trend (e.g., col, 
8). 

165. Referring to claim 47, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the step of examining multiple notifications comprises 
examining notifications for increases or decreases in a threshold value for a particular trend (e.g., 
col., 8). 

166. Referring to claims 48 and 54, Lin-Lucent discloses the claimed limitations as rejected 
above. Lin-Lucent also discloses accessing second data that indicates, for the particular 
component or interaction between the particular two or more components (e.g., col, 3), a set of 
one or more undesirable states or state transitions (e.g., col., 3); wherein each of said one or more 
undesirable states or state transitions is a state or state transition of the one or more states and 
state transitions that is associated with undesirable behavior (e.g., col., 6); and accessing third 
data that indicates, for the particular component or interaction between the particular two or 
more components, a set of one or more illegal states or state transitions (e.g., col, 6); wherein 
each of said one or more illegal states or state transitions is a state or state transition of the one or 
more states and state transitions that is associated with illegal behavior (e.g., col, 4); wherein the 
set of one or more illegal states is different from the set of one or more undesirable states (e.g., 
col, 4); wherein the particular state or state transition belongs to either the set of one or more 
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undesirable states or state transitions or the set of one or more illegal states or state transitions 
(e.g., col, 4). 

167. Referring to claim 49, Lin-Lucent discloses the claimed limitations as rejected above. 
Lin-Lucent also discloses wherein the specified states and state transitions comprise (1) a set of 
undesirable states or state transitions associated with undesirable behavior (e.g., col, 8) and (2) a 
set of illegal states or state transitions associated with illegal behavior, said set of illegal states 
and state transitions being different than said set of undesirable states or state transitions (e.g., 
col, 8). 

168. Referring to claims 50 and 55, Lin-Lucent discloses the claimed limitations as rejected 
above. Lin-Lucent also discloses wherein the first data is stored in a state table in a network 
management system, wherein the step of generating is performed by a component or agent 
separate from the network management system (e.g., col., 8). 

169. Referring to claims 5 1 and 56, Lin- Lucent discloses the claimed limitations as rejected 
above. Lin-Lucent also discloses wherein the first data is stored in a state table in the particular 
component or in at least one of the two or more particular components (e.g., col, 5). 

170. Referring to claims 53 and 58, Lin-Lucent discloses the claimed limitations as rejected 
above. Lin-Lucent also discloses wherein the particular state or state transition is a composite 
state transition (e.g., col, 4). 



Application/Control Number: 10/637,174 
Art Unit: 2154 



Page 47 



Response to Arguments 

111. Applicant's arguments with respect to the amended claims dated 2/22/2008 have been 
considered but are moot in view of the new ground(s) of rejection (the claims are amended over 
the claims dated 09/24/2007 that were rejected under the prior arts of the office action dated 
12/12/2007). 

Allowable Subject Matter 

111. New claims 52 and 57 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 

Conclusion 

In order to expedite the prosecution of this case, multiple references are used for the 
rejections to demonstrate that several references disclose the claimed subject matter of the 
claims. 

Examiner has cited particular columns and line numbers and/or paragraphs and/or 
sections and/or page numbers in the reference(s) as applied to the claims above for the 
convenience of the applicant. Although the specified citations are representative of the teachings 
of the art and are applied to the specific limitations within the individual claim, other passages 
and figures may apply as well. It is respectfully requested from the applicant in preparing 
responses, to fully consider the references in entirety, as potentially teaching, all or part of the 
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claimed invention, as well as the context of the passage, as taught by the prior art or disclosed by 
the Examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Haresh Patel whose telephone number is (571) 272-3973. The 
examiner can normally be reached on Monday, Tuesday, Thursday and Friday from 10:00 am to 
8:00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nathan Flynn, can be reached at (571) 272-1915. The fax phone number for the 
organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

/Haresh N. Patel/ 
Primary Examiner, Art Unit 2154 
5/25/2008 



